diff --git a/api/auth.go b/api/auth.go index 19da61b..93e7732 100644 --- a/api/auth.go +++ b/api/auth.go @@ -30,7 +30,14 @@ func (c *Client) CheckSession(ctx context.Context) bool { func (c *Client) Login(ctx context.Context) error { c.csrfToken = http.Cookie{} - data := Login{&GPGAuth{KeyID: c.userPrivateKey.GetFingerprint()}} + privateKey, err := c.getPrivateKey(c.userPrivateKey, c.userPassword) + if err != nil { + return fmt.Errorf("Parsing User Private Key: %w", err) + } + + defer privateKey.ClearPrivateParams() + + data := Login{&GPGAuth{KeyID: privateKey.GetFingerprint()}} res, _, err := c.DoCustomRequestAndReturnRawResponse(ctx, "POST", "/auth/login.json", "v2", data, nil) if err != nil && !strings.Contains(err.Error(), "Error API JSON Response Status: Message: The authentication failed.") { diff --git a/api/client.go b/api/client.go index 0ce0701..e97a134 100644 --- a/api/client.go +++ b/api/client.go @@ -26,8 +26,8 @@ type Client struct { // userPublicKey has been removed since it can be gotten from the private userPrivateKey - // be sure to make a copy since using ClearPrivateParams on a handler also wipes the key... - userPrivateKey *crypto.Key + userPassword []byte + userPrivateKey string userID string // Server Settings Determining which Resource Types we can use @@ -71,13 +71,23 @@ func NewClient(httpClient *http.Client, UserAgent, BaseURL, UserPrivateKey, User pgp := crypto.PGP() - var unlockedKey *crypto.Key = nil + // Verify that the Given Privatekey and Password are valid and work Together if we were provieded one if UserPrivateKey != "" { - key, err := GetPrivateKeyFromArmor(UserPrivateKey, []byte(UserPassword)) + privateKeyObj, err := crypto.NewKeyFromArmored(UserPrivateKey) if err != nil { - return nil, fmt.Errorf("Get Private Key: %w", err) + return nil, fmt.Errorf("Unable to Create Key From UserPrivateKey string: %w", err) } - unlockedKey = key + unlockedKeyObj, err := privateKeyObj.Unlock([]byte(UserPassword)) + if err != nil { + return nil, fmt.Errorf("Unable to Unlock UserPrivateKey using UserPassword: %w", err) + } + privateKeyRing, err := crypto.NewKeyRing(unlockedKeyObj) + if err != nil { + return nil, fmt.Errorf("Unable to Create a new Key Ring using the unlocked UserPrivateKey: %w", err) + } + + // Cleanup Secrets + privateKeyRing.ClearPrivateParams() } // Create Client Object @@ -85,7 +95,8 @@ func NewClient(httpClient *http.Client, UserAgent, BaseURL, UserPrivateKey, User httpClient: httpClient, baseURL: u, userAgent: UserAgent, - userPrivateKey: unlockedKey, + userPassword: []byte(UserPassword), + userPrivateKey: UserPrivateKey, pgp: pgp, } return c, err @@ -196,11 +207,11 @@ func (c *Client) GetPublicKey(ctx context.Context) (string, string, error) { } // Lets get the actual Fingerprint instead of trusting the Server - serverKey, err := crypto.NewKeyFromArmored(body.Keydata) + privateKeyObj, err := crypto.NewKeyFromArmored(c.userPrivateKey) if err != nil { return "", "", fmt.Errorf("Parsing Server Key: %w", err) } - return body.Keydata, serverKey.GetFingerprint(), nil + return body.Keydata, privateKeyObj.GetFingerprint(), nil } // setMetadataTypeSettings Gets and configures the Client to use the Types the Server wants us to use diff --git a/api/encryption.go b/api/encryption.go index c39eee3..3186f0d 100644 --- a/api/encryption.go +++ b/api/encryption.go @@ -8,12 +8,14 @@ import ( // EncryptMessage encrypts a message using the users public key and then signes the message using the users private key func (c *Client) EncryptMessage(message string) (string, error) { - key, err := c.userPrivateKey.Copy() + key, err := c.getPrivateKey(c.userPrivateKey, c.userPassword) if err != nil { - return "", fmt.Errorf("Get Private Key Copy: %w", err) + return "", fmt.Errorf("Get Private Key: %w", err) } - encHandle, err := c.pgp.Encryption().SigningKey(key).Recipient(c.userPrivateKey).New() + defer key.ClearPrivateParams() + + encHandle, err := c.pgp.Encryption().SigningKey(key).Recipient(key).New() if err != nil { return "", fmt.Errorf("New Encryptor: %w", err) } @@ -34,16 +36,18 @@ func (c *Client) EncryptMessage(message string) (string, error) { // EncryptMessageWithPublicKey encrypts a message using the provided public key and then signes the message using the users private key func (c *Client) EncryptMessageWithPublicKey(publickey, message string) (string, error) { + key, err := c.getPrivateKey(c.userPrivateKey, c.userPassword) + if err != nil { + return "", fmt.Errorf("Get Private Key: %w", err) + } + + defer key.ClearPrivateParams() + publicKey, err := crypto.NewKeyFromArmored(publickey) if err != nil { return "", fmt.Errorf("Get Public Key: %w", err) } - key, err := c.userPrivateKey.Copy() - if err != nil { - return "", fmt.Errorf("Get Private Key Copy: %w", err) - } - encHandle, err := c.pgp.Encryption().SigningKey(key).Recipient(publicKey).New() if err != nil { return "", fmt.Errorf("New Encryptor: %w", err) @@ -64,31 +68,29 @@ func (c *Client) EncryptMessageWithPublicKey(publickey, message string) (string, } // DecryptMessage decrypts a message using the users Private Key -func (c *Client) DecryptMessage(armoredCiphertext string) (string, error) { - key, err := c.userPrivateKey.Copy() - if err != nil { - return "", fmt.Errorf("Get Private Key Copy: %w", err) - } - - message, _, err := c.DecryptMessageWithPrivateKeyAndReturnSessionKey(key, armoredCiphertext) +func (c *Client) DecryptMessage(message string) (string, error) { + message, _, err := c.DecryptMessageWithPrivateKeyAndReturnSessionKey(c.userPrivateKey, c.userPassword, message) return message, err } // DecryptMessageWithPrivateKey Decrypts a Message using the Provided Private Key // Returns the Session key so that it can be saved in a cache -func (c *Client) DecryptMessageWithPrivateKeyAndReturnSessionKey(privateKey *crypto.Key, armoredCiphertext string) (string, *crypto.SessionKey, error) { +func (c *Client) DecryptMessageWithPrivateKeyAndReturnSessionKey(privateKey string, passphrase []byte, ciphertextArmored string) (string, *crypto.SessionKey, error) { + key, err := c.getPrivateKey(privateKey, passphrase) + if err != nil { + return "", nil, fmt.Errorf("Get Private Key: %w", err) + } - decHandle, err := c.pgp.Decryption(). - DecryptionKey(privateKey). - RetrieveSessionKey(). - New() + defer key.ClearPrivateParams() + + decHandle, err := c.pgp.Decryption().DecryptionKey(key).RetrieveSessionKey().New() if err != nil { return "", nil, fmt.Errorf("New Decryptor: %w", err) } defer decHandle.ClearPrivateParams() - res, err := decHandle.Decrypt([]byte(armoredCiphertext), crypto.Armor) + res, err := decHandle.Decrypt([]byte(ciphertextArmored), crypto.Armor) if err != nil { return "", nil, fmt.Errorf("Decrypt: %w", err) } @@ -96,7 +98,11 @@ func (c *Client) DecryptMessageWithPrivateKeyAndReturnSessionKey(privateKey *cry return res.String(), res.SessionKey(), nil } -func GetPrivateKeyFromArmor(privateKey string, passphrase []byte) (*crypto.Key, error) { +func (c *Client) getPrivateKey(privateKey string, passphrase []byte) (*crypto.Key, error) { + if c.userPrivateKey == "" { + return nil, fmt.Errorf("Client has no Private Key") + } + key, err := crypto.NewKeyFromArmored(privateKey) if err != nil { return nil, fmt.Errorf("Key From Armored: %w", err) diff --git a/api/verify.go b/api/verify.go index 8ed16e2..74e35b6 100644 --- a/api/verify.go +++ b/api/verify.go @@ -5,6 +5,7 @@ import ( "fmt" "strings" + "github.com/ProtonMail/gopenpgp/v3/crypto" "github.com/google/uuid" ) @@ -43,10 +44,15 @@ func (c *Client) SetupServerVerification(ctx context.Context) (string, string, e // VerifyServer verifys that the Server is still the same one as during the Setup, Only works before login func (c *Client) VerifyServer(ctx context.Context, token, encToken string) error { + privateKeyObj, err := crypto.NewKeyFromArmored(c.userPrivateKey) + if err != nil { + return fmt.Errorf("Parsing User Private Key: %w", err) + } + data := GPGVerifyContainer{ Req: GPGVerify{ Token: encToken, - KeyID: c.userPrivateKey.GetFingerprint(), + KeyID: privateKeyObj.GetFingerprint(), }, } raw, _, err := c.DoCustomRequestAndReturnRawResponse(ctx, "POST", "/auth/verify.json", "v2", data, nil)